import assert from "node:assert/strict";
import { existsSync, readFileSync, readdirSync } from "node:fs";
import { extname, join } from "node:path";
import test from "node:test";

const root = new URL("../", import.meta.url);

function source(path: string) {
  return readFileSync(new URL(path, root), "utf8");
}

function sourceFiles(path: string): string[] {
  const directory = new URL(path, root);
  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
    const child = join(directory.pathname, entry.name);
    if (entry.isDirectory()) {
      return sourceFiles(`${path}/${entry.name}`);
    }
    return [".ts", ".tsx"].includes(extname(entry.name)) ? [child] : [];
  });
}

test("operation-level admin email reauthentication is removed from routes and UI", () => {
  assert.equal(existsSync(new URL("src/app/api/admin/reauth/route.ts", root)), false);

  const adminSources = [
    ...sourceFiles("src/app/api/admin"),
    ...sourceFiles("src/components/admin"),
    ...sourceFiles("src/lib/admin"),
  ];
  for (const file of adminSources) {
    const contents = readFileSync(file, "utf8");
    assert.doesNotMatch(
      contents,
      /requireHighRiskAdminMutation|reauthPermission|\/api\/admin\/reauth|HIGH_RISK_ADMIN|issueHighRisk|verifyHighRisk/,
      file,
    );
  }
});

test("admin mutations retain session, permission, trusted-origin, server audit, request-id, and audit boundaries", () => {
  const http = source("src/lib/admin/http.ts");
  const codesRoute = source("src/app/api/admin/codes/route.ts");
  const codesHelper = source("src/lib/admin/codes.ts");
  const codesUi = source("src/components/admin/codes-resource.tsx");
  assert.equal(existsSync(new URL("src/components/admin/confirm-action-modal.tsx", root)), false);

  assert.match(http, /requirePermission\(permission, request\.headers\)/);
  assert.match(http, /isTrustedAdminMutationRequest\(request, process\.env\.ADMIN_USER_ORIGIN\)/);
  assert.match(codesRoute, /requireAdminMutation\([\s\S]*"admin\.access"/);
  assert.doesNotMatch(codesRoute, /reason:\s*z\.string/);
  assert.match(codesRoute, /p_reason:\s*"admin_console_create_redemption_codes"/);
  assert.match(codesHelper, /JSON\.stringify\(input\.p_codes\)/);
  assert.match(codesRoute, /requestId\(request\)/);
  assert.match(codesRoute, /admin_create_redemption_codes/);
  assert.match(codesUi, /permissions\.includes\("admin\.access"\)/);
  assert.match(codesUi, /onFinish=\{\(values\) => void submitCreate\(values\)\}/);
  assert.doesNotMatch(codesUi, /ConfirmActionModal|pendingCreate|pendingEdit|revokeRecord/);
});

test("account-level TOTP MFA and customer login email OTP remain available", () => {
  const mfaRoute = source("src/app/api/admin/mfa/route.ts");
  const mfaUi = source("src/components/admin/mfa-security.tsx");
  const loginUi = source("src/components/email-otp-login.tsx");

  assert.match(mfaRoute, /verifyTOTP|verifyBackupCode/);
  assert.match(mfaUi, /认证器验证码/);
  assert.match(loginUi, /邮箱验证码登录/);
  assert.match(loginUi, /验证并登录/);
});